Our android app only has Facebook login. Here's what happens on the server:

  • A user is created when a POST request is sent using Facebook's user access token in the body. Whenever a user gets created via a POST request, an API token is generated and sent as a response as follows:

        "message": "User Successfully Created",
        "api_token": "ACITyBKf0jKrfqOFumTMcaEEJ8jU151crRdESMPmBj8zbeENslULHfNXlKeo"

    I did this because the API token that is generated on the server is stored in the Android app's local storage and is needed to make other requests.

  • If the user already exists in the server the response would be:

        "message": "User Already Exists!!",
        "api_token": "ACITyBKf0jKrfqOFumTMcaEEJ8jU151crRdESMPmBj8zbeENslULHfNXlKeo"

    This is in case the user deletes the app and installs it again.

  • To submit a score, a PATCH request is to be sent with the following header and body:

    Content-Type: application/x-www-form-urlencoded
    api_token: ACITyBKf0jKrfqOFumTMcaEEJ8jU151crRdESMPmBj8zbeENslULHfNXlKeo
    fb_id: xxxxxxxxxx
    distance: 2
    golds: 19
    xp: 23

Now, the problem is that I have spotted a loophole.

A person can find out their Facebook user access token and their Facebook id anytime. So, if they make a POST request with that user access token, they will receive the api_token (in the "User Already Exists!!" response). And once they have api_token and fb_id, they can make a PATCH request to modify their scores to whatever they want.

What am I doing wrong? How can I prevent users from modifying their data like this?

  • Your server will not get hacked, the user's data will be modified without authorization. Think of it that way and your solution presents itself. You need to authorize changes, not just users. – schroeder Mar 16 '17 at 11:03
  • @schroeder How do I prevent that from happening? How do I authorize changes when users don't need a password? – jimmypage Mar 16 '17 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.